docs: remove duplicate local public documentation - #11

…oven#815) (OpenCoven#871)

* docs: plan cryptographic fresh-user and biometric assurance proofs (coven#815)

Specify COVEN-ASSURANCE/1, an independently verifiable step-up proof so
request authentication can satisfy FreshUserVerification/FreshBiometric
grant requirements without trusting client-asserted assurance levels.

The plan defines: possession/step-up key separation; binding the optional
step-up authorization key and its declared assurance class into the
pairing-v2 transcript; a separate authorization-key store; canonical
proof bytes over device, grant, revocation epoch, exact request or
DeviceActionIntent digest, server-issued single-use challenge, window,
and requested assurance; server-side effective assurance computed as
min(claimed, class ceiling) and passed to DeviceGrant::authorize;
fail-closed possession-only degradation; rotation/revocation semantics;
iOS/Android platform mapping; a self-verifying synthetic golden vector;
and TypeScript/JSON Schema for implementers. Every claim cites the
current mobile_memory code path it builds on.

No code changes: this is the design artifact the issue asks for.

Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>

* docs(mobile): specify COVEN-ASSURANCE/1 step-up assurance proofs

Add docs/design/mobile-assurance-step-up-v1.md, the plan and
implementation contract for issue OpenCoven#815: a separately enrolled,
platform-policy-protected step-up authorization key, bound into the
pairing-v2 transcript before grant issuance, whose fresh signatures
over canonical COVEN-ASSURANCE/1 bytes (device, grant, revocation
epoch, exact request or DeviceActionIntent digest, single-use server
challenge, validity window, requested assurance) are the only way to
raise assurance above possession. The server verifies the signature,
computes effective assurance itself, and passes it to
DeviceGrant::authorize; absent/invalid/expired/replayed proofs fail
closed. Covers storage separate from the possession key, replay
protection independent of request nonces, rotation/revocation
semantics, iOS/Android key-policy mapping, a security-invariant
mapping, TypeScript types + JSON Schema, and a portable golden vector.
Design artifact only; no behavior change.

Refs OpenCoven#815

Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>

---------

Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>

…heck (coven#859) (OpenCoven#862)

Establish the GitHub-side half of the OpenCoven#859 operational delivery graph:

- docs/roadmaps/coven-automations-v1.md: program roadmap with canonical
  tracker roles, sync metadata, P0/P1/P2 policy, generated outcome-mapping
  table, dependency graph, release gates, active blockers, and drift
  detection usage. The mapping table block is generated by
  docs/roadmaps/drift-check.mjs --render and verified on every run.
- docs/roadmaps/coven-automations-v1.mapping.json: machine-readable
  one-to-one Bead <-> GitHub mapping for OpenCoven#854, OpenCoven#816, OpenCoven#855, OpenCoven#856, OpenCoven#857,
  and OpenCoven#858, with explicit dependencies, acceptance gates, dispositions,
  and evidence links. Bead IDs stay null (warn-level W010) until
  provisioning lands through OpenCoven/coven-cave#5220 per the
  operational correction on OpenCoven#859; no competing Beads store is created
  in this repository.
- docs/roadmaps/drift-check.mjs: credential-free, offline drift check
  covering state, priority, parent/dependency, evidence, generated-mirror,
  duplicate/missing mapping, cycle, and sensitive-payload drift classes,
  with --beads-export cross-checking and --selftest proving detection.
- docs/superpowers/plans/2026-08-30-issue-859-coven-automations-v1-...md:
  dated status/decision record: what exists on main (automations series
  landed 2026-08-28 via PRs OpenCoven#846/OpenCoven#847), pre-change integrity report,
  decisions D1-D7, verdict against the OpenCoven#859 acceptance criteria,
  remaining work, critical path, and the initial evidence packet.

Refs OpenCoven#859



fix: keep automation tracker docs scanner-safe

Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>

The canonical install, platform, deployment, uninstall, and install-debugging guides are merged in OpenCoven/coven-docs, so the duplicate local pages under docs/install/ become stable pointers per the Wave A cleanup plan. docs/install/development-channels.md keeps its local content because no canonical page covers pre-release channels yet.

Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>

Duplicate local onboarding pages (quickstart, first session, onboarding, showcase, doctor) become pointers to the canonical getting-started and doctor routes. coven-tui.md keeps its legacy-TUI contract and its root-absolute links are fixed to the retained local session-lifecycle contract and the canonical CLI reference.

Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>

…boundary

The README stops duplicating the canonical manual and keeps the landing-page facts: what Coven is, one install and quick-start path, canonical links, the source-adjacent ownership table, contributor rules, and security. DOCS-MAINTENANCE.md gains the enforceable public-doc directory boundary (canonical pointers or source-adjacent exceptions with stated ownership reasons), and docs/index.md links to it.

Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>

No file changes. The pull request was opened before Actions was enabled on this fork, so no workflow run was created for its head SHA. This empty commit fires a pull_request synchronize event so the CI matrix can report.

Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>